Splunk Search

Creating a multivalue field from a result?

dshpritz
SplunkTrust
SplunkTrust

Hey everyone,

So this feels like something I should be able to do with the standard search language, but I am failing at it.

I have a result, coming from a custom command, that contains field like this:

entries.0.category\_name, entries.1.category\_name,...,entries.n.category\_name

I would like to take all of these and either create a multi-value field with all of the values in them, or create just one string joining all of the values of entries.*.category_name together, with a comma.

I want something like:

| eval mvjoin(entries.*.category_name, ",")

But Splunk does not like that.

Any thoughts?

Thanks,

Dave

1 Solution

_d_
Splunk Employee
Splunk Employee

Try this:

...| eval categories = "" | foreach entries.*.category_name [eval categories='<<FIELD>>' + "," + categories]| makemv delim="," categories

View solution in original post

_d_
Splunk Employee
Splunk Employee

Try this:

...| eval categories = "" | foreach entries.*.category_name [eval categories='<<FIELD>>' + "," + categories]| makemv delim="," categories

aelliott
Motivator

So basically he has fields that are named "entries.InsertNumberHere.category_name" and would like to combine them into one multi-value field. Variably Named columns.

dshpritz
SplunkTrust
SplunkTrust

Hey somesoni2,

Thanks for the suggestion, but I want to join the values across an unknown number of fields, each named entries.n.category. That is, my example above is the field names, not the value in the fields.

Thanks,

Dave

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try split command.

| | eval fieldName=split(fieldName, ",")

This will split value in the fieldName by comma and create a multivalued field out of it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...